Monday, June 11. 2018

An overworked team with an impossible mission, creating a secure Internet browser, on Windows, is called to the weekly time-waster product team meeting.

Product Manager:
Team, you know that Edge needs to be the most secure browser on the planet, right?
So how can this thing segfault if some dude from the security consultancy fuzzes the Backup.dat?

You MUST make sure this is protected. It MUST be a violation of Windows Policy to modify the file. Go, make it happen! Report back next week!

The team disperses.

Early next morning, at a set of tables in the middle of a dimly lit cube farm...

Developer:
Hey, team lead, do you know what the PM meant with "Windows Policy"? I never heard about a "Windows Policy". Is this the "Group Policy"? Or did he mean the product license? Like the shrink-wrap contract? Do we need to consult legal?

Team lead:
Oh, ffs, Bob. No time for discussion. The requirement is crystal clear. Implement it. You're the security lead. We have a deadline approaching.

Developer:
O.k., boss. I'll see what I can do.

O Rly?

This is unfortunately not a joke. I found this in a Windows client backup log:

While you're at it, please admire the beauty of the URL. Underscores or dashes? Short slugs? Four Insiders? Let's tack a UUID on top, always good to have UUIDs! And NEWID is so easy to use in SQL Server. IDENTITY is two more keystrokes.

Next time, I'll do a piece on that bug report, how swearing at support people doesn't help and why an "Insider Preview" program is totally worth it ... if somebody were actually monitoring the feedback.

And why the second answer in that forum is better SEO than the work that went into the clean URL.

And why you have %LOCALAPPDATA% and still use the home directory to store browser cookie backup files in the first place.

...

Update:

13.06.18: Even the Windows registry has this security - ehem - feature applied:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\EUPP Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\DHP]

E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.

Enter the string from the spam-prevention image above:

Remember Information?

Submitted comments will be subject to moderation before being displayed.